Another type of AE characterization work leverages the instability of AEs for detection [1]}, [2]}, [3]}, [4]}. Mutation Testing [3]} performs model mutation (e.g., changing neuron activation values) and evaluates the prediction inconsistency for AE detection. While effective, it requires a large number of executions to run for each input sample, causing significant inference overheads. Liang et. al. [4]} regard the adversarial perturbations as a kind of noise and implement two classical denoising techniques to mitigate their impact. Both the input image and its de-noised version are fed into the target classifier, and the input sample is regarded as an AE if their classification results are inconsistent. Similarly, Feature Squeezer (FS) [1]} and VisionGuard [2]} propose to feed the input and its squeezed/compressed version to the DNN model and check the result difference for AE detection. While simple to deploy, these defense techniques provide moderate robustness enhancement for the target model, and they are also vulnerable to adaptive attacks.
